What Is a Firewall and How Does It Protect Servers?
A firewall is a security system that monitors and controls incoming and outgoing network traffic based on predetermined rules. It acts as a barrier between trusted and untrusted networks, allowing legitimate traffic while blocking potentially harmful connections.
How Firewalls Work
Firewalls inspect each network packet against a set of rules. Based on the rule match, the firewall either allows the packet to pass (accept), blocks it (drop or reject), or logs it for analysis.
Packet inspection can examine: - Source and destination IP addresses - Source and destination port numbers - Protocol type (TCP, UDP, ICMP) - Connection state (new, established, related) - Packet content (in application-layer firewalls)
Types of Firewalls
Host-Based Firewalls
A host-based firewall runs on the server itself. Linux provides iptables/nftables for packet filtering and UFW (Uncomplicated Firewall) as a user-friendly interface.
Host-based firewalls protect individual servers regardless of network-level protections. Every production server should have a host-based firewall configured.
Network Firewalls
Network firewalls are dedicated devices or virtual appliances that protect entire network segments. They sit at network boundaries and filter traffic entering or leaving the segment.
Cloud Security Groups
Cloud platforms provide security groups as virtual firewalls for cloud instances. Security groups define allowed inbound and outbound traffic at the instance level, enforced by the hypervisor.
Linux Firewall Tools
UFW (Uncomplicated Firewall)
UFW provides a simple command-line interface for managing iptables rules:
sudo ufw default deny incoming sudo ufw default allow outgoing sudo ufw allow ssh sudo ufw allow http sudo ufw allow https sudo ufw enable
iptables
iptables provides fine-grained control over packet filtering:
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT sudo iptables -A INPUT -j DROP
nftables
nftables is the successor to iptables in modern Linux kernels, providing a more efficient and flexible rule syntax.
Firewall Best Practices
- Default deny: block all traffic by default, allow only what is needed
- Principle of least privilege: open only the ports your applications require
- Document all firewall rules with comments explaining their purpose
- Log denied connections for security analysis
- Regularly audit firewall rules and remove obsolete entries
- Use separate rules for management access (SSH) and application traffic
- Consider rate limiting for SSH and other sensitive services
Common Firewall Configurations
Web server: allow SSH (22), HTTP (80), HTTPS (443), deny everything else Database server: allow SSH (22), database port from application servers only Application server: allow SSH (22), application port from load balancer only
Conclusion
Firewalls are a fundamental security control for every server. Whether using UFW, iptables, nftables, or cloud security groups, the principle is the same: deny by default, allow only what is necessary, and monitor for suspicious activity.